oslo-incubator

  1. Bug #1100282
  2. Comment #7

Comment 7 for bug 1100282

Revision history for this message
Dolph Mathews (dolph) wrote : Re: DoS through XML entity expansion

Since essex, there is definitely a way to disable XML. We opt to translate XML<-->JSON in middleware so that the application itself only has to speak JSON.

It's included by keystone.conf.sample, but you can remove the keystone.middleware:XmlBodyMiddleware from your application pipelines to completely disable XML support.